@hotmeshio/long-tail 0.4.3 → 0.4.4

package/build/api/settings.js

@@ -6,6 +6,7 @@ const events_1 = require("../lib/events");
 const nats_1 = require("../lib/events/nats");
 const socketio_1 = require("../lib/events/socketio");
 const defaults_1 = require("../modules/defaults");
+const llm_1 = require("../services/llm");
 /**
  * Return platform settings for the current deployment.
  *
@@ -39,6 +40,9 @@ async function getSettings() {
                         ? (process.env.VITE_NATS_WS_URL || process.env.NATS_WS_URL || null)
                         : null,
                 },
+                ai: {
+                    enabled: (0, llm_1.hasLLMApiKey)(),
+                },
             },
         };
     }

package/build/lib/db/index.d.ts

@@ -8,11 +8,5 @@ export declare function closePool(): Promise<void>;
  */
 export declare function getConnection(): {
     class: typeof Client;
-    options: {
-        host: string;
-        port: number;
-        user: string;
-        password: string;
-        database: string;
-    };
+    options: Record<string, unknown>;
 };

package/build/lib/db/schemas/008_capability_reaction.sql

@@ -0,0 +1,12 @@
+-- Add 'capability' reaction type and server_id/tool_name columns
+-- for late-binding MCP tool invocation via agent subscriptions.
+
+ALTER TABLE lt_agent_subscriptions
+  DROP CONSTRAINT IF EXISTS lt_agent_subscriptions_reaction_type_check;
+
+ALTER TABLE lt_agent_subscriptions
+  ADD CONSTRAINT lt_agent_subscriptions_reaction_type_check
+  CHECK (reaction_type IN ('durable', 'pipeline', 'mcp_query', 'capability'));
+
+ALTER TABLE lt_agent_subscriptions ADD COLUMN IF NOT EXISTS server_id TEXT;
+ALTER TABLE lt_agent_subscriptions ADD COLUMN IF NOT EXISTS tool_name TEXT;

package/build/lib/db/schemas/009_file_topic_category.sql

@@ -0,0 +1,10 @@
+-- Add 'file' to the topic catalog category check constraint.
+
+ALTER TABLE lt_topic_catalog
+  DROP CONSTRAINT IF EXISTS lt_topic_catalog_category_check;
+
+ALTER TABLE lt_topic_catalog
+  ADD CONSTRAINT lt_topic_catalog_category_check
+  CHECK (category IN (
+    'task','workflow','escalation','activity','knowledge','file','agent','app','milestone'
+  ));

package/build/lib/events/index.d.ts

@@ -31,6 +31,15 @@ declare class LTEventRegistry {
      * Return the first registered adapter that matches the given type.
      */
     getAdapter<T extends LTEventAdapter>(ctor: new (...args: any[]) => T): T | undefined;
+    /**
+     * Bridge cross-container events to the in-process callback adapter.
+     *
+     * Iterates all registered adapters and calls `setCallbackBridge()` on
+     * any that implement it. This is the generic contract — any transport
+     * adapter (NATS, SNS, GCP Pub/Sub, Kafka) that supports cross-process
+     * delivery implements `setCallbackBridge` on the LTEventAdapter interface.
+     */
+    bridgeCallbackAdapter(callbackAdapter: LTEventAdapter): void;
 }
 /** Singleton event registry */
 export declare const eventRegistry: LTEventRegistry;

package/build/lib/events/index.js

@@ -59,6 +59,21 @@ class LTEventRegistry {
     getAdapter(ctor) {
         return this.adapters.find((a) => a instanceof ctor);
     }
+    /**
+     * Bridge cross-container events to the in-process callback adapter.
+     *
+     * Iterates all registered adapters and calls `setCallbackBridge()` on
+     * any that implement it. This is the generic contract — any transport
+     * adapter (NATS, SNS, GCP Pub/Sub, Kafka) that supports cross-process
+     * delivery implements `setCallbackBridge` on the LTEventAdapter interface.
+     */
+    bridgeCallbackAdapter(callbackAdapter) {
+        for (const adapter of this.adapters) {
+            if (adapter !== callbackAdapter && typeof adapter.setCallbackBridge === 'function') {
+                adapter.setCallbackBridge(callbackAdapter);
+            }
+        }
+    }
 }
 /** Singleton event registry */
 exports.eventRegistry = new LTEventRegistry();

package/build/lib/events/nats.d.ts

@@ -1,10 +1,16 @@
 import type { LTEvent, LTEventAdapter } from '../../types';
 /**
- * NATS event adapter — reference implementation.
+ * NATS event adapter — publish AND subscribe.
  *
  * Publishes LTEvent payloads as JSON to NATS subjects
  * following the pattern: `{subjectPrefix}.{event.type}`
  *
+ * When a CallbackEventAdapter is bridged via `setCallbackBridge()`,
+ * this adapter also subscribes to `{subjectPrefix}.>` and forwards
+ * events from other containers to the local callback adapter.
+ * An `_originId` field prevents the publishing container from
+ * re-dispatching its own events.
+ *
  * Usage:
  * ```typescript
  * import { eventRegistry, NatsEventAdapter } from '@hotmeshio/long-tail';
@@ -15,14 +21,22 @@ import type { LTEvent, LTEventAdapter } from '../../types';
  */
 export declare class NatsEventAdapter implements LTEventAdapter {
     private nc;
+    private sub;
     private url;
     private subjectPrefix;
     private token?;
+    private originId;
+    private callbackAdapter;
     constructor(options?: {
         url?: string;
         subjectPrefix?: string;
         token?: string;
     });
+    /**
+     * Bridge NATS → local callback adapter for cross-container dispatch.
+     * Part of the LTEventAdapter contract. Call before `connect()`.
+     */
+    setCallbackBridge(adapter: LTEventAdapter): void;
     connect(): Promise<void>;
     publish(event: LTEvent): Promise<void>;
     disconnect(): Promise<void>;

package/build/lib/events/nats.js

@@ -1,16 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NatsEventAdapter = void 0;
+const crypto_1 = require("crypto");
 const nats_1 = require("nats");
 const config_1 = require("../../modules/config");
 const logger_1 = require("../logger");
 const sc = (0, nats_1.StringCodec)();
 /**
- * NATS event adapter — reference implementation.
+ * NATS event adapter — publish AND subscribe.
  *
  * Publishes LTEvent payloads as JSON to NATS subjects
  * following the pattern: `{subjectPrefix}.{event.type}`
  *
+ * When a CallbackEventAdapter is bridged via `setCallbackBridge()`,
+ * this adapter also subscribes to `{subjectPrefix}.>` and forwards
+ * events from other containers to the local callback adapter.
+ * An `_originId` field prevents the publishing container from
+ * re-dispatching its own events.
+ *
  * Usage:
  * ```typescript
  * import { eventRegistry, NatsEventAdapter } from '@hotmeshio/long-tail';
@@ -22,24 +29,59 @@ const sc = (0, nats_1.StringCodec)();
 class NatsEventAdapter {
     constructor(options) {
         this.nc = null;
+        this.sub = null;
+        this.originId = (0, crypto_1.randomUUID)();
+        this.callbackAdapter = null;
         this.url = options?.url || config_1.config.NATS_URL;
         this.subjectPrefix = options?.subjectPrefix || 'lt.events';
         this.token = options?.token || process.env.NATS_TOKEN || 'dev_api_secret';
     }
+    /**
+     * Bridge NATS → local callback adapter for cross-container dispatch.
+     * Part of the LTEventAdapter contract. Call before `connect()`.
+     */
+    setCallbackBridge(adapter) {
+        this.callbackAdapter = adapter;
+    }
     async connect() {
         this.nc = await (0, nats_1.connect)({
             servers: this.url,
             token: this.token,
         });
         logger_1.loggerRegistry.info(`[lt-events:nats] connected to ${this.url}`);
+        // Subscribe to all events for cross-container bridging
+        if (this.callbackAdapter) {
+            const adapter = this.callbackAdapter;
+            this.sub = this.nc.subscribe(`${this.subjectPrefix}.>`);
+            logger_1.loggerRegistry.info(`[lt-events:nats] subscribed to ${this.subjectPrefix}.> for cross-container bridge`);
+            (async () => {
+                for await (const msg of this.sub) {
+                    try {
+                        const event = JSON.parse(sc.decode(msg.data));
+                        // Skip events that originated from this container
+                        if (event._originId === this.originId)
+                            continue;
+                        adapter.publish(event);
+                    }
+                    catch {
+                        // Malformed message — skip
+                    }
+                }
+            })();
+        }
     }
     async publish(event) {
         if (!this.nc)
             return;
         const subject = `${this.subjectPrefix}.${event.type}`;
-        this.nc.publish(subject, sc.encode(JSON.stringify(event)));
+        const enriched = { ...event, _originId: this.originId };
+        this.nc.publish(subject, sc.encode(JSON.stringify(enriched)));
     }
     async disconnect() {
+        if (this.sub) {
+            this.sub.unsubscribe();
+            this.sub = null;
+        }
         if (this.nc) {
             await this.nc.drain();
             this.nc = null;

package/build/lib/events/publish.d.ts

@@ -66,6 +66,16 @@ export declare function publishKnowledgeEvent(params: {
     domain: string;
     key: string;
 }): Promise<void>;
+/**
+ * Publish a file storage event (stored, deleted).
+ * Includes rich metadata: path, name, extension, mime type, size.
+ */
+export declare function publishFileEvent(params: {
+    type: 'file.stored' | 'file.deleted';
+    path: string;
+    size?: number;
+    mime?: string;
+}): Promise<void>;
 /**
  * Publish an agent lifecycle event.
  */

package/build/lib/events/publish.js

@@ -5,6 +5,7 @@ exports.publishTaskEvent = publishTaskEvent;
 exports.publishEscalationEvent = publishEscalationEvent;
 exports.publishActivityEvent = publishActivityEvent;
 exports.publishKnowledgeEvent = publishKnowledgeEvent;
+exports.publishFileEvent = publishFileEvent;
 exports.publishAgentEvent = publishAgentEvent;
 exports.publishWorkflowEvent = publishWorkflowEvent;
 const index_1 = require("./index");
@@ -105,6 +106,33 @@ function publishKnowledgeEvent(params) {
         timestamp: new Date().toISOString(),
     });
 }
+/**
+ * Publish a file storage event (stored, deleted).
+ * Includes rich metadata: path, name, extension, mime type, size.
+ */
+function publishFileEvent(params) {
+    const parsed = params.path.split('/');
+    const filename = parsed[parsed.length - 1] || '';
+    const dotIdx = filename.lastIndexOf('.');
+    const name = dotIdx > 0 ? filename.slice(0, dotIdx) : filename;
+    const extension = dotIdx > 0 ? filename.slice(dotIdx + 1) : '';
+    return fireAndForget({
+        type: params.type,
+        source: 'file-storage',
+        workflowId: '',
+        workflowName: '',
+        taskQueue: '',
+        data: {
+            path: params.path,
+            name,
+            extension,
+            filename,
+            mime: params.mime,
+            size: params.size,
+        },
+        timestamp: new Date().toISOString(),
+    });
+}
 /**
  * Publish an agent lifecycle event.
  */

package/build/modules/config.d.ts

@@ -10,10 +10,4 @@ export declare const config: {
     JWT_SECRET: string;
     HONEYCOMB_API_KEY: string;
 };
-export declare const postgres_options: {
-    host: string;
-    port: number;
-    user: string;
-    password: string;
-    database: string;
-};
+export declare const postgres_options: Record<string, unknown>;

package/build/services/agent/subscription-sql.d.ts

@@ -1,7 +1,7 @@
 export declare const LIST_SUBSCRIPTIONS = "\n  SELECT * FROM lt_agent_subscriptions\n  WHERE agent_id = $1\n  ORDER BY created_at\n";
 export declare const GET_SUBSCRIPTION = "\n  SELECT * FROM lt_agent_subscriptions WHERE id = $1\n";
-export declare const INSERT_SUBSCRIPTION = "\n  INSERT INTO lt_agent_subscriptions\n    (agent_id, topic, filter, reaction_type, workflow_type, pipeline_id, mcp_prompt,\n     input_mapping, execute_as, enabled)\n  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)\n  RETURNING *\n";
-export declare const UPDATE_SUBSCRIPTION = "\n  UPDATE lt_agent_subscriptions SET\n    topic = COALESCE($2, topic),\n    filter = COALESCE($3, filter),\n    reaction_type = COALESCE($4, reaction_type),\n    workflow_type = COALESCE($5, workflow_type),\n    pipeline_id = COALESCE($6, pipeline_id),\n    mcp_prompt = COALESCE($7, mcp_prompt),\n    input_mapping = COALESCE($8, input_mapping),\n    execute_as = COALESCE($9, execute_as),\n    enabled = COALESCE($10, enabled)\n  WHERE id = $1\n  RETURNING *\n";
+export declare const INSERT_SUBSCRIPTION = "\n  INSERT INTO lt_agent_subscriptions\n    (agent_id, topic, filter, reaction_type, workflow_type, pipeline_id, mcp_prompt,\n     input_mapping, execute_as, enabled, server_id, tool_name)\n  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)\n  RETURNING *\n";
+export declare const UPDATE_SUBSCRIPTION = "\n  UPDATE lt_agent_subscriptions SET\n    topic = COALESCE($2, topic),\n    filter = COALESCE($3, filter),\n    reaction_type = COALESCE($4, reaction_type),\n    workflow_type = COALESCE($5, workflow_type),\n    pipeline_id = COALESCE($6, pipeline_id),\n    mcp_prompt = COALESCE($7, mcp_prompt),\n    input_mapping = COALESCE($8, input_mapping),\n    execute_as = COALESCE($9, execute_as),\n    enabled = COALESCE($10, enabled),\n    server_id = COALESCE($11, server_id),\n    tool_name = COALESCE($12, tool_name)\n  WHERE id = $1\n  RETURNING *\n";
 export declare const DELETE_SUBSCRIPTION = "\n  DELETE FROM lt_agent_subscriptions WHERE id = $1\n";
-export declare const SEED_SUBSCRIPTION = "\n  INSERT INTO lt_agent_subscriptions\n    (agent_id, topic, filter, reaction_type, workflow_type, pipeline_id, mcp_prompt,\n     input_mapping, execute_as, enabled)\n  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, true)\n  ON CONFLICT (agent_id, topic) DO NOTHING\n";
+export declare const SEED_SUBSCRIPTION = "\n  INSERT INTO lt_agent_subscriptions\n    (agent_id, topic, filter, reaction_type, workflow_type, pipeline_id, mcp_prompt,\n     input_mapping, execute_as, enabled, server_id, tool_name)\n  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, true, $10, $11)\n  ON CONFLICT (agent_id, topic) DO NOTHING\n";
 export declare const LIST_ACTIVE_SUBSCRIPTIONS = "\n  SELECT s.*, a.id AS agent_name, a.user_id AS agent_user_id\n  FROM lt_agent_subscriptions s\n  JOIN lt_agents a ON s.agent_id = a.id\n  WHERE s.enabled = true AND a.status = 'active'\n  ORDER BY s.created_at\n";

package/build/services/agent/subscription-sql.js

@@ -12,8 +12,8 @@ exports.GET_SUBSCRIPTION = `
 exports.INSERT_SUBSCRIPTION = `
   INSERT INTO lt_agent_subscriptions
     (agent_id, topic, filter, reaction_type, workflow_type, pipeline_id, mcp_prompt,
-     input_mapping, execute_as, enabled)
-  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+     input_mapping, execute_as, enabled, server_id, tool_name)
+  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
   RETURNING *
 `;
 exports.UPDATE_SUBSCRIPTION = `
@@ -26,7 +26,9 @@ exports.UPDATE_SUBSCRIPTION = `
     mcp_prompt = COALESCE($7, mcp_prompt),
     input_mapping = COALESCE($8, input_mapping),
     execute_as = COALESCE($9, execute_as),
-    enabled = COALESCE($10, enabled)
+    enabled = COALESCE($10, enabled),
+    server_id = COALESCE($11, server_id),
+    tool_name = COALESCE($12, tool_name)
   WHERE id = $1
   RETURNING *
 `;
@@ -36,8 +38,8 @@ exports.DELETE_SUBSCRIPTION = `
 exports.SEED_SUBSCRIPTION = `
   INSERT INTO lt_agent_subscriptions
     (agent_id, topic, filter, reaction_type, workflow_type, pipeline_id, mcp_prompt,
-     input_mapping, execute_as, enabled)
-  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, true)
+     input_mapping, execute_as, enabled, server_id, tool_name)
+  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, true, $10, $11)
   ON CONFLICT (agent_id, topic) DO NOTHING
 `;
 exports.LIST_ACTIVE_SUBSCRIPTIONS = `

package/build/services/agent/subscriptions.d.ts

@@ -3,10 +3,12 @@ export interface AgentSubscription {
     agent_id: string;
     topic: string;
     filter?: Record<string, any>;
-    reaction_type: 'durable' | 'pipeline' | 'mcp_query';
+    reaction_type: 'durable' | 'pipeline' | 'mcp_query' | 'capability';
     workflow_type?: string;
     pipeline_id?: string;
     mcp_prompt?: string;
+    server_id?: string;
+    tool_name?: string;
     input_mapping: Record<string, any>;
     execute_as?: string;
     enabled: boolean;

package/build/services/agent/subscriptions.js

@@ -32,6 +32,8 @@ async function createSubscription(agentId, data) {
         JSON.stringify(data.input_mapping ?? {}),
         data.execute_as ?? null,
         data.enabled !== false,
+        data.server_id ?? null,
+        data.tool_name ?? null,
     ]);
     return rows[0];
 }
@@ -48,6 +50,8 @@ async function updateSubscription(id, data) {
         data.input_mapping ? JSON.stringify(data.input_mapping) : null,
         data.execute_as ?? null,
         data.enabled ?? null,
+        data.server_id ?? null,
+        data.tool_name ?? null,
     ]);
     return rows[0] ?? null;
 }
@@ -77,6 +81,8 @@ async function seedSubscription(agentId, data) {
         data.mcp_prompt ?? null,
         JSON.stringify(data.input_mapping ?? {}),
         data.execute_as ?? null,
+        data.server_id ?? null,
+        data.tool_name ?? null,
     ]);
     return (rowCount ?? 0) > 0;
 }

package/build/services/agent/trigger-registry.js

@@ -214,6 +214,7 @@ class AgentTriggerRegistry {
                     data: mapped.data ?? mapped,
                     execute_as: sub.execute_as ?? sub.agent_user_id ?? undefined,
                     source: 'agent',
+                    jobId: deterministicId,
                 });
                 break;
             }
@@ -226,6 +227,23 @@ class AgentTriggerRegistry {
                 });
                 break;
             }
+            case 'capability': {
+                logger_1.loggerRegistry.info(`[long-tail] agent capability: ${sub.agent_name} → ${sub.tool_name} on ${sub.server_id} (id=${deterministicId})`);
+                const { invokeWorkflow } = await Promise.resolve().then(() => __importStar(require('../workflow-invocation')));
+                await invokeWorkflow({
+                    workflowType: 'capabilityInvoke',
+                    data: {
+                        serverId: sub.server_id,
+                        toolName: sub.tool_name,
+                        arguments: mapped,
+                    },
+                    metadata: { source: 'agent' },
+                    executeAs: sub.execute_as ?? sub.agent_user_id ?? undefined,
+                    options: { workflowId: deterministicId },
+                    auth: { userId: sub.agent_user_id || 'lt-system', role: 'admin' },
+                });
+                break;
+            }
         }
     }
 }

package/build/services/topics/system-topics.js

@@ -158,6 +158,35 @@ const SYSTEM_TOPICS = [
         example_payload: { domain: 'orders', key: 'order-12345' },
         tags: ['lifecycle', 'knowledge'],
     },
+    // File storage
+    {
+        topic: 'file.stored',
+        description: 'A file has been written to storage.',
+        category: 'file',
+        payload_schema: objectSchema({
+            path: { type: 'string', description: 'File path in storage' },
+            name: { type: 'string', description: 'File name without extension' },
+            extension: { type: 'string', description: 'File extension (without dot)' },
+            filename: { type: 'string', description: 'Full filename with extension' },
+            mime: { type: 'string', description: 'MIME type' },
+            size: { type: 'number', description: 'File size in bytes' },
+        }),
+        example_payload: { path: '/images/photo.jpg', name: 'photo', extension: 'jpg', filename: 'photo.jpg', mime: 'image/jpeg', size: 245760 },
+        tags: ['lifecycle', 'file', 'storage'],
+    },
+    {
+        topic: 'file.deleted',
+        description: 'A file has been removed from storage.',
+        category: 'file',
+        payload_schema: objectSchema({
+            path: { type: 'string', description: 'File path in storage' },
+            name: { type: 'string', description: 'File name without extension' },
+            extension: { type: 'string', description: 'File extension (without dot)' },
+            filename: { type: 'string', description: 'Full filename with extension' },
+        }),
+        example_payload: { path: '/images/photo.jpg', name: 'photo', extension: 'jpg', filename: 'photo.jpg' },
+        tags: ['lifecycle', 'file', 'storage'],
+    },
     // Agent lifecycle
     {
         topic: 'agent.started',

package/build/services/yaml-workflow/deployer.d.ts

@@ -30,7 +30,7 @@ export declare function activateYamlWorkflow(appId: string, version: string): Pr
 /**
  * Invoke a YAML workflow (fire-and-forget). Returns the job ID.
  */
-export declare function invokeYamlWorkflow(appId: string, topic: string, data: Record<string, unknown>, entity?: string): Promise<string>;
+export declare function invokeYamlWorkflow(appId: string, topic: string, data: Record<string, unknown>, entity?: string, context?: Record<string, any>): Promise<string>;
 /**
  * Invoke a YAML workflow and wait for the result.
  *

package/build/services/yaml-workflow/deployer.js

@@ -136,9 +136,9 @@ async function activateYamlWorkflow(appId, version) {
 /**
  * Invoke a YAML workflow (fire-and-forget). Returns the job ID.
  */
-async function invokeYamlWorkflow(appId, topic, data, entity) {
+async function invokeYamlWorkflow(appId, topic, data, entity, context) {
     const engine = await getEngine(appId);
-    return engine.pub(topic, data, undefined, entity ? { entity } : undefined);
+    return engine.pub(topic, data, context, entity ? { entity } : undefined);
 }
 /**
  * Invoke a YAML workflow and wait for the result.

package/build/services/yaml-workflow/invoke.d.ts

@@ -7,6 +7,8 @@ interface InvokeOptions {
     userId?: string;
     /** Source identifier for metadata injection (e.g., 'cron') */
     source?: string;
+    /** Deterministic job ID for idempotent execution (agent subscriptions) */
+    jobId?: string;
 }
 /**
  * Invoke a YAML workflow with scope injection.

package/build/services/yaml-workflow/invoke.js

@@ -71,10 +71,14 @@ async function invokeYamlWorkflow(wf, options = {}) {
             data._metadata = {};
         data._metadata.source = options.source;
     }
+    // Build context with deterministic job ID when provided (agent subscriptions)
+    const context = options.jobId
+        ? { metadata: { jid: options.jobId } }
+        : undefined;
     if (options.sync) {
         const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, data, options.timeout, wf.graph_topic);
         return { job_id, result };
     }
-    const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, data, wf.graph_topic);
+    const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, data, wf.graph_topic, context);
     return { job_id: jobId };
 }

package/build/start/adapters.js

@@ -8,7 +8,6 @@ const honeycomb_1 = require("../lib/telemetry/honeycomb");
 const events_1 = require("../lib/events");
 const nats_1 = require("../lib/events/nats");
 const socketio_1 = require("../lib/events/socketio");
-const callback_1 = require("../lib/events/callback");
 const maintenance_1 = require("../services/maintenance");
 const maintenance_2 = require("../modules/maintenance");
 const mcp_1 = require("../services/mcp");
@@ -36,24 +35,27 @@ function registerAdapters(startConfig) {
     else if (startConfig.telemetry?.honeycomb) {
         telemetry_1.telemetryRegistry.register(new honeycomb_1.HoneycombTelemetryAdapter(startConfig.telemetry.honeycomb));
     }
-    // Events — always register socket.io (zero-cost until HTTP server attaches).
-    // NATS is additive: when configured, events publish to both transports.
+    // Events — register the configured transport.
+    // Socket.IO is the default for single-container ("nothing but Postgres").
+    // When NATS or custom adapters are configured, Socket.IO is NOT registered —
+    // the dashboard auto-detects the transport via GET /api/settings and connects
+    // directly (e.g., NATS WebSocket). Socket.IO never interferes in production.
     if (startConfig.events?.adapters) {
         for (const adapter of startConfig.events.adapters) {
             events_1.eventRegistry.register(adapter);
         }
     }
+    else if (startConfig.events?.nats) {
+        events_1.eventRegistry.register(new nats_1.NatsEventAdapter(startConfig.events.nats));
+    }
     else {
-        if (startConfig.events?.nats) {
-            events_1.eventRegistry.register(new nats_1.NatsEventAdapter(startConfig.events.nats));
-        }
         events_1.eventRegistry.register(new socketio_1.SocketIOEventAdapter({
             authenticate: (0, socket_auth_1.createSocketIOAuthenticator)(startConfig),
         }));
     }
-    // Always register the callback adapter for SDK event subscriptions.
-    // Zero-cost when no listeners are registered.
-    events_1.eventRegistry.register(new callback_1.CallbackEventAdapter());
+    // CallbackEventAdapter is registered later in start/workers.ts
+    // so it can be wired to the NATS bridge before connect().
+    // Do NOT register a duplicate here.
     // Maintenance
     if (startConfig.maintenance === false) {
         // Disabled

package/build/start/config.js

@@ -61,6 +61,10 @@ function applyDatabaseConfig(db) {
             database: db.database ?? config_1.postgres_options.database,
         });
     }
+    // SSL passthrough — applies to both connectionString and individual-field modes
+    if (db.ssl !== undefined) {
+        config_1.postgres_options.ssl = db.ssl;
+    }
 }
 /**
  * Apply server port and auth settings from the startup config.

package/build/start/workers.js

@@ -278,11 +278,20 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
             }
         }
     }
-    // Register the in-process callback adapter for agent event triggers
+    // Register the in-process callback adapter for agent event triggers.
+    // Reuse existing instance if already registered (e.g., from SDK createClient).
     const { CallbackEventAdapter } = await Promise.resolve().then(() => __importStar(require('../lib/events/callback')));
     const { agentTriggerRegistry } = await Promise.resolve().then(() => __importStar(require('../services/agent/trigger-registry')));
-    const callbackAdapter = new CallbackEventAdapter();
-    events_1.eventRegistry.register(callbackAdapter);
+    let callbackAdapter = events_1.eventRegistry.getAdapter(CallbackEventAdapter);
+    if (!callbackAdapter) {
+        callbackAdapter = new CallbackEventAdapter();
+        events_1.eventRegistry.register(callbackAdapter);
+    }
+    // Bridge cross-container events to the local callback adapter.
+    // Any transport adapter (NATS, SNS, GCP Pub/Sub, etc.) that implements
+    // setCallbackBridge() will subscribe to the bus and forward events
+    // from other containers so agent triggers fire locally.
+    events_1.eventRegistry.bridgeCallbackAdapter(callbackAdapter);
     // Connect event adapters (outside workers guard so API-only containers
     // still connect to NATS and can publish/receive events)
     if (events_1.eventRegistry.hasAdapters) {

package/build/system/index.js

@@ -71,6 +71,12 @@ const SYSTEM_WORKFLOW_BASE = {
     invocable: false,
 };
 const systemWorkflowConfigs = {
+    capabilityInvoke: {
+        defaultRole: ENGINEER,
+        roles: [],
+        invocable: true,
+        description: 'Late-binding MCP tool invocation — calls a single capability with idempotent execution',
+    },
     mcpTriageRouter: {
         ...SYSTEM_WORKFLOW_BASE,
         description: 'Triage router — discovers compiled workflows for remediation, routes to deterministic or dynamic triage',
@@ -110,6 +116,16 @@ const systemWorkflowConfigs = {
 };
 function getSystemWorkers() {
     const workers = [];
+    // Capability invoke — always available (no LLM required)
+    try {
+        const { capabilityInvoke } = require('./workflows/capability-invoke');
+        workers.push({
+            taskQueue: 'long-tail-system',
+            workflow: capabilityInvoke,
+            config: systemWorkflowConfigs.capabilityInvoke,
+        });
+    }
+    catch { /* module not available */ }
     const hasLLM = process.env.OPENAI_API_KEY || process.env.ANTHROPIC_API_KEY;
     if (hasLLM) {
         const pairs = [